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BSA | The Software Alliance’s submission to the 
European Strategy for Data consultation 


BSA | The Software Alliance (BSA)* welcomes the opportunity to provide feedback 
in response to the European Strategy for Data. BSA is the leading advocate for the 
global software industry. Our members are at the forefront of software-enabled 
innovation that is fueling global economic growth by helping enterprises in every 
sector of the economy operate more efficiently. As global leaders in the development 
of data-driven products and services, BSA members have unique insights into how a 
European Data Strategy could encourage the uptake of Al tools, data analytics and 
how it could further help the EU to become a leading role model for a society 
empowered by data to make better decisions — in business and the public sector. 


Data is the lifeblood of the modern digital economy — powering innovation and growth 
across the globe and enabling organizations to create new jobs, boost efficiency, 
drive quality, and improve output. BSA is strongly supportive of the European 
Strategy for Data released in February 2020, as sound and innovative data policies 
are fundamental to ensure the EU’s primary role in the global economy. 


In particular, the ability for companies to access and share data has a significant 
influence on economic development and growth, on a large scale due to its relevance 





1 BSA | The Software Alliance (www.bsa.org) is the leading advocate for the global software industry 
before governments and in the international marketplace. Its members are among the world’s most 
innovative companies, creating software solutions that spark the economy and improve modern life. 
With headquarters in Washington, DC, and operations in more than 30 countries, BSA pioneers 
compliance programs that promote legal software use and advocates for public policies that foster 
technology innovation and drive growth in the digital economy. 


BSA’s members include: Adobe, Akamai, Atlassian, Autodesk, Bentley Systems, Box, Cadence, 
Cloudflare, CNC/Mastercam, IBM, Informatica, Intel, Intuit, MathWorks, McAfee, Microsoft, Okta, 
Oracle, PTC, Salesforce, ServiceNow, Siemens Industry Software Inc., Sitecore, Slack, Splunk, Trend 
Micro, Trimble Solutions Corporation, Twilio, and Workday. 
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on the development of Al. Moreover, as European and Europe-based companies face 
the unprecedented challenges born out of the COVID-19 crisis, it becomes even 
more important to ensure balanced rules and guidelines for the management of 
personal and non-personal data. In this context, BSA would like to submit the 
following recommendations with regards to the Data strategy and upcoming policies. 


1) Ensure Data Can Move Freely Across Borders. As the European Strategy 


for Data rightly points out “European companies operate in a connected 
environment that goes beyond the EU’s borders, so that international data flows 
are indispensable for their competitiveness.” 


The free flow of data across borders is critical for the services that sustain 
global commerce, improve health and safety, promote social good, and enable 
the technologies of the future. For example, data transfers are integral to every 
stage of the Al life cycle, from the development of predictive models to the 
deployment and use of Al systems. The data used in Al systems often 
originates from many geographically dispersed sources, making it imperative 
that data can move freely across borders. Rules that limit cross-border data 
transfers invariably limit the insights and other benefits that Al systems can 
provide. In the EU context, BSA and its Members have been strong supporters 
of the EU Free Flow of Data Regulation,? as we continue to work with the 
European Commission in the implementation of the Regulation and supporting 
the Commission's efforts to further the objectives of the Regulation. 


When it comes to personal data, the GDPR provides a list of mechanisms that 
can be used by organizations to comply with the Regulation’s general principles 
and specific requirements when transferring personal data outside the EU and 
EEA. Different organization types and business models require the use of 
different transfer mechanisms that are not interchangeable. It is important that 
businesses be able to continue using the full range of existing GDPR-compliant 
data transfer mechanisms, such as: adequacy decisions (including on the EU- 
US Privacy Shield framework or Privacy Shield); certifications; codes of 
conduct; Binding Corporate Rules (BCRs); and Standard Contractual Clauses 
(SCCs). These mechanisms are critical to support global data flows and are 
built with strong safeguards. 





2 For more information please visit https://www.bsa.org/news-events/news/bsa-welcomes-the- 
agreement-on-free-flow-of-data-regulation 
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2) Common European Data Spaces. The creation of “Common European Data 


Spaces” in strategic sectors as foreseen in the Strategy has the potential to 
greatly increase the innovation potential of Europe’s economy with immense 
benefits to society. These data spaces need to be accessible to all market 
participants, both commercial and non-commercial, and enable an ecosystem 
where all participants can use and access data in a trusted, safe and secure 
environment. BSA would like to stress that a regulatory framework for the data 
governance of these data spaces should lay out high-level rules for open, 
transparent and structured stakeholder involvement and decision-making 
processes to provide the necessary flexibility and legal certainty to empower 
market participants and the public sector to participate in data spaces. 


However, a horizontal legislation on data governance should not be 
prescriptive and focus on setting high-level rules aimed at addressing 
compatibility and participatory issues around data spaces. Specific vertical 
data spaces may need adapted holistic data governance rules to ensure that 
innovation is not constrained within these sectors, and that trust is 
maintained. 


The development and adoption of the contemplated data spaces can and 
should be implemented in phases. For example, the data spaces can begin 
with creating open data environments, including government data released 
under open data licenses, to develop a culture of data sharing and free 
exchange among participants. Targeting open data first will enable the 
development of the data governance practices, standards, and data licensing 
infrastructure needed to establish robust data sharing environments without 
the complexity of managing duelling commercial interests. 


While these data spaces will be populated by stakeholders such as businesses, 
research institutions, individuals, and governmental entities, the scope should 
clearly identify what types of data will feed into the data spaces. This will require 
a continuous dialogue between policymakers and all relevant stakeholders. 
Finally, the data spaces should allow for participation from a broad range of 
stakeholders as well as placing all market players who comply with European 
legislation and the EU Acquis, regardless of their size and their origin, on equal 
footing. 
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3) Promote Voluntary Industry Data Sharing. While there is increasing 


recognition of the collective benefits that data sharing produces, the 
establishment of collaborative data sharing arrangements can be impeded by 
a range of technical, legal, and organizational challenges. In particular BSA 
encourages the European Commission to support the development, 
availability, and adoption of tools and best practices that make it easier and 
less expensive to share data in ways that are consistent with rigorous privacy 
expectations. Technical tools, such as application programming interfaces 
(APIs), can facilitate data exchanges that are faster and more secure than 
traditional transfers and create opportunities for empowering the public with 
greater access to their own data. Some level of standardization may be 
required in this area, but any standards developed should be market-led, 
developed in cooperation with industry, and recognize the specificities of 
sectors and use cases and take into account and build upon the many existing 
standards in this area. 


In addition to technical tools, the European Commission should look for 
opportunities to promote the development and use of standardized data 
licensing models. Much as the development of standardized open source 
licenses gave rise to a new model for software innovation, standardized data 
license agreements can facilitate new collaborative approaches for sharing 
data resources. The Linux Community Data License Agreement? and the 
Open Use Data Agreement? are good examples of industry efforts to create 
tools that will democratize the value of data by making it easier for all 
stakeholders to voluntarily share data in a manner that is predictable and 
trustworthy. 


Improved access to data need not come at the expense of privacy. Indeed, a 
range of privacy-enhancing technologies and data governance structures can 
enable value-added uses of data without compromising the confidentiality or 
security of the underlying data. To that end, the European Commission should 
promote the use of privacy enhancing technologies — such as differential 
privacy, homomorphic encryption, and federated machine learning — to create 
opportunities for sharing data while preserving individual privacy. The 
European Commission should likewise support the development of innovative 
data governance structures — such as data trusts, data cooperatives, and data 
commons -— that facilitate public and private sharing of data in ways that 
preserve privacy while enabling participants to benefit from the analysis of 





3 The Linux Foundation Projects, Community Data License Agreement, https://cdla.io/ 
4 Microsoft, The Open Use of Data Agreement, https://github.com/microsoft/Open-Use-of-Data- 
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potentially sensitive data. Investments in R&D and the creation of regulatory 
sandboxes can also help spur the development of such arrangements. 

To foster the data economy and enable data spaces, a more uniform 
interpretation and application of the GDPR is necessary to move towards a 
higher degree of harmonization between Member States. Providing more legal 
certainty through EDPB guidelines and a standardised industry approach which 
includes a risk-based view to the anonymisation of data is a key factor to 
incentivise more data sharing and usage. 

Furthermore, the proposed e-Privacy regulation should ensure consistency 
with the GDPR requirements (for instance with regard to the legal grounds for 
processing of personal data). As the e-Privacy regulation in its latest drafting 
will also apply to non-personal data, the scope of the regulation needs to be 
clarified to make sure that the uptake of data usage in all sectors and 
technologies as cloud computing, Al or edge computing are not negatively 
impacted. Additionally, outstanding cybersecurity issues including with regard 
to software updates in the proposed e-Privacy draft Regulation need to be 
resolved to avoid unnecessary and unintended practical issues. 


4) Access to Government Data and Public Sector Information. Government- 
generated data is a resource that can serve as a powerful engine for creating 
new jobs and promoting economic growth. At both the local and national level, 
governments collect and generate vast quantities of data that can be harnessed 
in the development of Al systems, data analytics and more broadly would allow 
for a stronger and more interconnected industry. 

In this context: 

a. Putting government-held data to use: Sound data policies should 
ensure that any non-sensitive government-generated data asset is 
made freely available to the public in machine-readable formats. This 
data — a resource whose full potential would otherwise go unrealized 
— can improve services and lower prices. For instance, an Al system 
designed to improve supply chain efficiency might rely on government 
data about historical traffic flows, law enforcement event advisories, 
and weather patterns to recommend delivery routes that minimize 
congestion, reduce emissions, and improve public safety. 
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5) 


6) 


b. Preventing data lock-up through procurement: Governments should 
carefully consider the effect that procurement policies can have on the 
availability of data. As a general matter, governments should avoid 
service agreements that would grant exclusive access or use rights to 
government datasets to any single private entity. Increasingly, 
government data is being generated by third-party vendors. For 
instance, local transit authorities may contract with third-party vendors 
to analyze data generated by buses and trains, or by sensors 
embedded in street lights and roadways. Governments contracting for 
such services should ensure that any statistical data created or 
maintained on its behalf as part of the agreement is not subject to 
access or use restrictions. Rather, data provided to governments as 
part of such procurement contracts should be treated like any other 
government data asset and should be made freely accessible for public 
use. 


BSA and its Members support the recently updated EU Directive on the 
Re-Use of Public Sector Information and agrees with the European 
Commission's efforts to make specific high-value public datasets 
available, where appropriate, as there is significant potential in its re- 
use in new products and services. 


Share Computing and Data Resources. There are opportunities to bridge the 
gap between organizations that produce data and the technology companies 
that develop cutting-edge data analytics tools and platforms. BSA encourages 
the European Commission to support public-private partnerships and other 
incentives for voluntary sharing initiatives that unlock the collective benefits of 
data. 


Facilitate Value-Added Data Services. Data is the key to growth in all sectors 
of the economy, but each piece of data has little inherent value. It is only when 
used as an input to other value-added services, that it contributes to the 
projected $15 trillion addition to global GDP by 2030.° Policies that artificially 
increase the costs for acquiring data will ultimately increase the costs of 
innovative technologies for customers and decrease the incentive to develop 





5 BSA, What’s the Deal with Big Data, available at https://data.bsa.org/wp- 
content/uploads/2015/12/bsadatastudy_ en.pdf 
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7) 


and use new technology — potentially reducing overall consumer welfare. The 
European Commission should pursue policies that facilitate the business-to- 
business exchange of data, including by: 
a. Ensuring companies can enter enforceable contracts that create data 
sharing arrangements; 
b. Avoiding the creation of new rights in business data that could add 
unnecessary transaction costs; and 
c. Allowing companies to freely perform data analytics, including Text and 
Data Mining (“TDM”), on any content to which they have lawful access. 


BSA and its Members have been strong advocates for a mandatory exception 
for TDM in the EU Copyright Directive, and strongly encourage the European 
Commission to ensure the appropriate implementation of the text of Art. 4 of 
the Directive, to ensure strong protections for rightsholders, while providing for 
legal certainty for data innovators and researchers. 


Cloud and edge computing. The European Strategy for Data suggests 
creating a Cloud Rulebook that would serve as a repository of applicable rules, 
including codes of conduct and certifications for cloud services. BSA welcomes 
the idea to centralize and document industry-led standards that can bring more 
clarity to customers when navigating the cloud landscape. In this context, BSA 
would support the idea of setting-up a cloud services marketplace, that would 
help demonstrate the vibrant market for cloud solutions in Europe, a potential 
that is still under tapped. However, this should not lead to measures at EU or 
national levels that may impose market access or other unjustified barriers, 
such as preferential treatment or data localisation measures. 


BSA and its members would like to stress that the approach to strengthening 
Europe’s cloud infrastructure should be inclusive, open and based on trust 
and credentials. Strengthening technological capacity-building and working 
with like-minded partners that have strong commitments to Europe go hand- 
in-hand, regardless of the location of their headquarters. Transparency, 
interoperability and openness should be the key fundamentals to an open, 
secure and future-facing European data infrastructure. 





€ For more information please visit https://www.bsa.org/news-events/news/bsa-applauds-eu-decision- 
to-enact-mandatory-exception-for-text-and-data-mining-in-copyright-directive 
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Also, and as the Strategy notes, there is a low cloud uptake in Europe (with 
one 1 company in 4 on average, only 1 in 5 for SMEs’) including in the 
European public. We would encourage the European Commission to further 
promote cloud adoption in both the private and public sector throughout the 
European Union. Initiatives that can promote the legal certainty around the use 
of cloud can be helpful, but they also need to be consistently implemented 
across Member States. 

The recent and still ongoing COVID-19 has shown that using software and 
cloud services can improve the ability of employees to collaborate, companies 
to reach consumers, and governments to reach citizens in a secure and 
efficient manner. In this regard, the recently released BSA Response and 
Recovery Agenda® highlights a number of policy priorities and strategic 
initiatives that could be fostered in the EU to enable governments and their 
citizens to prepare for and implement increased remote working, resilient 
education systems, and other remote-based activities. Among these 
recommendations, encouraging and enabling the use of software and cloud 
services for continued business and government operations as well as 
promoting responsible migration to cloud services are essential to contribute to 
the success of the digital transformation of European industry and society. 
BSA and its Members would welcome the opportunity to further explore ways 
to support the Commission's efforts to develop policies and initiatives to drive 
better cloud adoption throughout the EU 


8) Workforce Development and Education. The increasing use of and demand 


for technology is creating new types of jobs in every sector of the economy that 
require an evolving set of skills. Tasks associated with jobs across many 
sectors are not the same today as they were just 20 years ago. Yet, as job 
requirements change, new technologies are generating job growth and 
enhancing productivity. 


In arecent Report, Software.org found that software companies directly employ 
almost 3.6 million people in the European Union, with a Total Value-Added 
GDP of €1 trillion.? These trends will become even more prominent with the 
growing use of emerging technologies, such as artificial intelligence. BSA 





7 https://ec.europa.eu/eurostat/statistics-explained/index.php/Cloud computing - 





statistics on the use by enterprises 





8 https://www.bsa.org/files/policy-filings/05272020bsaresponserecoveryagendaa4.pdf 





9 For more information please visit https://software.org/wp- 


content/uploads/EU_2018 Economic Impact factsheet _EU.pdf, and for the Report on the Economic 
Impact of Software in the EU please visit https://software.org/reports/2018-eu-software-impact/ 





Avenue des Arts 44 P +32 (0)2 274 13 10 
1040 Brussels W bsa.org 
Belgium EU Register of Interest Representatives 75039383277-48 


strongly supports the European Commission objective to facilitate Member 
States efforts to further increase data literacy and ensure a stronger population 
and workforce”. 

In this context, we would recommend: 


a. 


Improve Access to STEM Education: STEM education equips students 
with problem solving, critical thinking, and other abilities that are 
important for jobs in virtually every industry. Making STEM education 
inclusive and widely available builds interest in developing in-demand 
skills and expands the available workforce for technology-related jobs. 


Expand Workforce Retraining: Emerging technologies will create new 
jobs and change the skills demanded in many existing jobs. In addition 
to preparing the next generation workforce, we must ensure the current 
workforce has access to the skills needed as the job market evolves. 
Filling the digital skills gap does not only consist in building large data 
science teams and having people developing and administering data 
models. It is also important to address the data literacy at all levels of 
organizations, including the executive teams, to ensure they feel 
empowered to take strategic business decisions based on their data. 


Create Alternative Pathways to the Evolving Workforce: As our 
economy changes, we need to consider whether our education model 
should change as well. In the new economy, technical schools, 
apprenticeships, boot camps, and other alternative pathways may be 
just as effective as traditional classrooms in generating the skills and 
interests necessary to thrive in 21st century careers. 


kkk 


For further information, please contact: 
Thomas Boué, Director General, Policy - EMEA 


thomasb@bsa.org or +32.2.274.1315 


10 See for instance the BSA’s “2019 Germany Workforce Agenda “: https://www.bsa.org/files/policy- 
filings/03112019enBSAGermanWorkforceDevelopmentAgenda.pdf and BSA’s “2019 France 
Workforce Agenda“ https://www. bsa.org/files/policy- 
filings/03112019enBSAFrenchWorkforceDevelopmentAgenda.pdf 
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